NCSC CAF · UK Cyber Assessment Framework
NCSC CAF assessment and requirements, met with outcomes your regulator can follow.
The Cyber Assessment Framework is how most UK cyber regulators, and government through GovAssure, judge whether an essential service is secure and resilient. Sterling's expert and experienced consultants work through the fourteen principles with your teams, fix what falls short and build the evidence for your self-assessment and any independent review. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced cyber resilience consultants, with security management systems consulting delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. No CAF certificate exists; your regulator or oversight body reviews and decides
8,100+ client engagements in 60+ countries.
NCSC CAF client experience
What it is
What is the NCSC CAF and what is it used for?
The Cyber Assessment Framework is published by the UK National Cyber Security Centre. It first appeared in 2018 for organisations under the Network and Information Systems (NIS) Regulations and has since become the common yardstick for critical national infrastructure and much of the public sector.
It is organised as four objectives, fourteen principles beneath them and, under each principle, contributing outcomes. Every outcome carries indicators of good practice arranged in columns: achieved, not achieved and, for some outcomes, partially achieved. The NCSC is explicit that these indicators inform expert judgement and are not a rigid checklist. Target profiles then say which outcomes must reach which level: a Basic profile for all sectors and a sector-specific Enhanced profile built on it, with your oversight body telling you which applies.
The NCSC advises; it does not regulate. Your competent authority or oversight body decides how the CAF applies to you, so speak to it before using the CAF for a regulatory return.
Current version. CAF v4.0, released on 6 August 2025, with a published record of changes from v3.2. Separately, the Cyber Security and Resilience Bill, which would amend the NIS Regulations, was still before Parliament in September 2026; check its status and your regulator's timetable before you plan.
Who it is for
Who needs an NCSC CAF assessment?
The CAF reaches organisations whose failure would hurt the country: energy, transport, health, digital infrastructure and government. Requests usually arrive from one of four directions:
- Your regulator asks for a CAF return. Most NIS competent authorities have adopted the CAF, so the first question is which profile and which deadline yours has set.
- A government customer passes it down. Public bodies assessing their own critical systems may ask the suppliers who run or support those systems for CAF-aligned evidence.
- You sit in government-sector CNI. GovAssure makes CAF assessment mandatory for in-scope departments and arm's length bodies.
- A group company already reports against it. Sister operators in regulated sectors often align on one CAF approach across the group.
Requirements
What are the main NCSC CAF requirements?
The requirements are the outcomes behind fourteen principles, grouped under four objectives. The list below stays at principle level; your assessment works from the contributing outcomes and indicators in the NCSC's own text.
- Objective A, managing security risk: A1 Governance, A2 Risk management, A3 Asset management, A4 Supply chain.
- Objective B, protecting against cyber attack: B1 Service protection policies, processes and procedures, B2 Identity and access control, B3 Data security, B4 System security, B5 Resilient networks and systems, B6 Staff awareness and training.
- Objective C, detecting cyber security events: C1 Security monitoring, C2 Threat hunting.
- Objective D, minimising the impact of incidents: D1 Response and recovery planning, D2 Lessons learned.
- New in v4.0: a contributing outcome on understanding threat under A2 and one on secure software development and support under A4, with security monitoring under C1 restructured.
What does useful CAF evidence look like?
A statement of essential functions and supporting systems, board papers showing who owns the risk, a threat picture, asset and supplier registers, access reviews, tested restores, triaged alerts and an incident exercise whose lessons were acted on. Each claim of "achieved" should point to a record, not a policy alone.
Assessment process
How does an NCSC CAF assessment work?
There is no certification body in the CAF. The usual pattern is a self-assessment against the profile your oversight body sets, followed by its review or an independent audit.
- 01Define essential functions and the target profile.Agree which services matter, which systems support them, and whether the Basic or an Enhanced profile applies.
- 02Gap analysis: rate each contributing outcome accurately.We test current practice against the indicators of good practice and record the evidence for every rating.
- 03Close the gaps that matter to the profile.Remediation is prioritised by the outcomes the profile demands, then by risk to the essential function.
- 04Complete the self-assessment.Ratings and justifications go into the format your regulator uses; under GovAssure that is WebCAF.
- 05Support the review and the improvement plan.Your regulator, or an independent auditor it accepts, reviews the return; agreed improvements are tracked to closure.
Check the route before you sign. Independent CAF-based audits are assured by the NCSC through its Cyber Resilience Audit scheme, and GovAssure reviews must use suppliers registered on it. If an audit is required, confirm the provider is listed as an Assured Service Provider and ask your regulator whether it accepts that audit. Any "CAF certificate" on offer is not an NCSC product. The certification buyer's checklist
Cost
How much does NCSC CAF compliance cost?
The biggest cost is usually remediation, not paperwork: the gap between current practice and the profile is what drives the budget.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Essential functions and systems in scope, the target profile, current maturity, and whether you choose Design™ or Drive™ |
| Independent audit | Only where your regulator or GovAssure requires one; quoted by an assured provider and shown separately |
| Technical remediation | Monitoring, logging, access control, backup or network segregation that is missing today |
| Your team's time | Operations, IT, OT and supplier managers gathering evidence and running exercises |
| Software and learning | Effivity and Sterling Academy access, itemised at no additional cost |
What moves the price
- Basic or Enhanced profile
- Operational technology inside the scope
- Number of sites, systems and critical suppliers
What a Sterling proposal always shows
- Deliverables, assumptions and exclusions in writing
- Milestones linked to your submission date
- One all-inclusive proposal for our work
Timeline
How long does NCSC CAF compliance take?
Your regulator's deadline usually fixes the end date. What fills the time is remediation, above all monitoring and recovery capabilities, and the months needed to show they work. As an estimate, most programmes take four to nine months.
| Phase | What sets the pace |
|---|---|
| Scoping and gap analysis | Agreement on essential functions and access to system owners |
| Remediation | Procurement and change windows, especially in operational technology |
| Evidence and exercises | Enough operating history to justify each "achieved" rating |
| Submission and review | The regulator's or auditor's calendar and follow-up questions |
Your engagement
What your NCSC CAF engagement includes
Sterling OS™ runs every engagement, adapted to outcomes rather than clauses. Sterling does not certify or audit your CAF return: your regulator or oversight body, or the independent auditor it accepts, reviews it and draws the conclusion.
Design™: guided support
Your security and operations teams do the work; a Sterling consultant sets the method, challenges each rating and reviews the evidence.
Drive™: managed support
The alternative to Design™ when time is short: Sterling drafts policies, registers and justifications with your owners and runs the programme to submission.
Sustain™: after submission
Annual reassessment, v4.0 changes absorbed, incident exercises and improvement plan follow-up.
Automate™: Effivity
Your outcomes, evidence and actions run in Effivity, included with the engagement at no additional cost.
Training for your people
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Assessment conclusions remain with your regulator or oversight body.
Often combined with
Standards organisations pair with NCSC CAF
- ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
- CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
- CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
- CSA STARCSA STAR certification consulting for cloud providers: CCM controls and evidence for a STAR Registry entry by self-assessment, certification or attestation.
- Cyber EssentialsCyber Essentials certification consulting: the five technical controls in place for your verified self-assessment, and Cyber Essentials Plus audit-ready.
- DESC ISR (Dubai)DESC ISR compliance consulting for Dubai government entities and suppliers: information security risks and incidents managed, with the evidence to show it.
Effivity · cyber resilience workspace, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of CAF v4.0.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. For a CAF client, your consultant configures the workspace within the agreed scope: risks, assets, suppliers, policies, audits, incidents, corrective actions, training records and board reporting, each linked to the contributing outcome it supports. When the next return is due, the justification for each rating is already on file. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Board ownership and roles
Who is accountable for each essential function, with board decisions and security reports kept together.
Risks and threat picture
Risks tied to the systems behind each essential function, with treatments followed to closure.
Systems and dependencies
An inventory of the systems, data and services that matter, owned and reviewed.
Supplier assurance
Critical suppliers assessed, contract obligations recorded and follow-ups dated.
Competence records
Training by role, linked to Sterling Academy, so awareness can be shown rather than asserted.
Incidents and exercises
Incidents logged and analysed, recovery tests and exercises recorded with their results.
Corrective action
Root causes and actions from incidents and reviews, with proof that the fix stuck.
Outcome ratings and evidence
Fields and reports configured without code, so each rating links to the records behind it.
What this means at the review
A reviewer testing a claim of "achieved" will ask what shows it. With Effivity, the risk entry, the restore test, the supplier assessment or the exercise report is one click from the rating, dated and owned.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for EMS, OHSMS, ISMS, FSMS and more when you integrate other standards
Sterling Academy · cybersecurity e-learning
Make cyber resilience part of every role, not only the security team.
Sterling Academy provides video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion that can be checked online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness training that supports the staff awareness and training principle
- Internal auditor training, as applicable to your standard, as part of the engagement
- Progress reports by team, ready for your self-assessment
- New starters trained as they join, so records stay current
Keep exploring
Explore more about NCSC CAF
NCSC CAF resources
Services for NCSC CAF
Why Sterling
Want a successful NCSC CAF assessment? Come to Sterling.
Operators of essential services seldom have one framework to meet. Sterling ties the CAF to the ISO/IEC 27001, continuity and NIS2 work you may already run, so one set of evidence answers several reviewers.
60+ countries since 2003
Security and resilience programmes for utilities, transport, health and technology providers, with offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal; any independent audit shown separately.
Ratings that hold up
Every "achieved" backed by records, so the review confirms your return instead of downgrading it.
Expert and experienced consultants
Specialists who understand both IT and operational technology, and judge outcomes the way a reviewer will.
The Sterling Promise
What our NCSC CAF success guarantee means
We stay with you until your agreed NCSC CAF outcome is achieved, through remediation, the self-assessment and the closure of any review findings.
The engagement identifies the framework, profile, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. Your regulator or oversight body reviews the assessment and retains its conclusions. Our commitment concerns the agreed assessment support, not a promise of every future regulatory finding or flawless performance.
FAQs
Frequently asked questions about the NCSC CAF
Is there an NCSC CAF certification?
No. The CAF is an assessment framework, and the NCSC does not issue certificates against it. What you get is an assessed position against a profile, reviewed by your regulator or an assured independent auditor.
Does ISO/IEC 27001 certification satisfy the CAF?
Not on its own. An ISO/IEC 27001 system supplies much of the governance, risk and supplier evidence, but the CAF focuses on essential functions and asks for outcomes, such as monitoring and recovery, that a certificate does not prove.
Do we have to reach "achieved" on every outcome?
Only where your profile demands it. The Basic and Enhanced profiles set the level expected for each outcome, and your regulator decides which applies to you.
Can suppliers use the CAF if they are not regulated?
Yes. Any organisation can use it to assess itself, and suppliers to operators or government often do so because their customers ask for CAF-aligned evidence.
How often is a CAF assessment repeated?
That depends on your regulator or, for government, on the GovAssure cycle. Plan for a yearly review at least, and confirm the timing with your oversight body.
Keep exploring
More on NCSC CAF and related standards
More in Information security, cyber & cloud
Talk to a consultant
Prepare your NCSC CAF self-assessment before the regulator asks.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice